Archive
June 2021
Vulnerabilities first published in this month (UTC), newest first.
1,711 results · Feed
-
Medium 4.4
Default client side session signing key is highly predictable
Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the client side session module uses the application startup time as the signing key by default. This means that if an attacker can determine this time, and if encryption is not al…
-
Unscored —
Cross Site Scripting vulnerability in ZrLog 2.1.0 via the (1) userName and (2) email parameters in post/addComment.
-
High 8.8
TIBCO Spotfire Windows Platform Artifact Search vulnerability
The TIBCO Spotfire Server and TIBCO Enterprise Runtime for R components of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire …
-
High 8.8
TIBCO Spotfire Windows Platform Installation vulnerability
The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplac…
-
Unscored —
SQL Injection vulnerability in Zhong Bang Technology Co., Ltd CRMEB mall system V2.60 and V3.1 via the tablename parame…
-
High 7.5CVE-2021-22119 Public exploit
Resource Exhaustion in Spring Security
Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux app…
-
Medium 4.3
IBM Planning Analytics 2.0 could be vulnerable to cross-site request forgery (CSRF) which could allow an attacker to ex…
-
Medium 4.0
IBM Spectrum Protect Plus 10.1.0 through 10.1.8 could allow a local user to cause a denial of service due to insecure f…
-
Medium 5.4
IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Ja…
-
Unscored —
Machform prior to version 16 is vulnerable to an open redirect in Safari_init.php due to an improperly sanitized 'ref' …
-
Unscored —
Machform prior to version 16 is vulnerable to unauthenticated remote code execution due to insufficient sanitization of…
-
Unscored —
Machform prior to version 16 is vulnerable to stored cross-site scripting due to insufficient sanitization of file atta…
-
Unscored —
Machform prior to version 16 is vulnerable to cross-site request forgery due to a lack of CSRF tokens in place.
-
Unscored —
Machform prior to version 16 is vulnerable to HTTP host header injection due to improperly validated host headers. This…
-
High 8.8
A memory corruption vulnerability exists in the DMG File Format Handler functionality of PowerISO 7.9. A specially craf…
-
Unscored —
FATEK Automation WinProladder Versions 3.30 and prior are vulnerable to an out-of-bounds write, which may allow an atta…
-
Unscored —
FATEK Automation WinProladder Versions 3.30 and prior do not properly restrict operations within the bounds of a memory…
-
Unscored —
FATEK Automation WinProladder Versions 3.30 and prior are vulnerable to an out-of-bounds read, which may allow an attac…
-
High 7.0
Cached redirect poisoning via X-Forwarded-Host header
Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a user supplied `X-Forwarded-Host` header can be used to perform cache poisoning of a cache fronting a Ratpack server if the cache key does not include the `X-Forwarded-Host` head…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninj…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninj…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Deskt…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Deskt…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Deskt…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Deskt…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Deskt…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Deskt…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Deskt…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Deskt…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenText Brav…
-
Medium 6.8
This vulnerability allows attackers with physical access to escalate privileges on affected installations of Arlo Q Plu…
-
Critical 9.0
An improper input validation vulnerability of ZOOK software (remote administration tool) could allow a remote attacker …
-
Critical 9.6
Helpu remote code execution vulnerability
A remote code execution vulnerability exists in helpUS(remote administration tool) due to improper validation of parameter of ShellExecutionExA function used for login.
-
Unscored —CVE-2021-34824 Public exploit
Istio (1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1) contains a remotely exploitable vulnerability where credentials specified …
-
Medium 6.4
A memory corruption vulnerability exists when ezPDF improperly handles the parameter. This vulnerability exists due to …
-
Unscored —
Zoho ManageEngine ServiceDesk Plus MSP before 10521 is vulnerable to Server-Side Request Forgery (SSRF).
-
Unscored —
Zoho ManageEngine ServiceDesk Plus MSP before 10522 is vulnerable to Information Disclosure.
-
Unscored —
Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data.
-
High 7.5
A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exi…
-
High 7.5
Use-after-free in BinDiff
An attacker can craft a specific IdaPro *.i64 file that will cause the BinDiff plugin to load an invalid memory offset. This can allow the attacker to control the instruction pointer and execute arbitrary code. It is recommended to upgrade BinDiff 7